Organization’s IT risk profile refers to the risk-taking propensity of the firm with respect to IT: e.g., deploying emerging new IT systems and applications that have not been sufficiently tested yet.